WordPress InPost for WooCommerce Plugin <= 1.4.0 is vulnerable to Arbitrary File Deletion

Software InPost for WooCommerce Type Plugin Vulnerable versions = 1.4.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-6500 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 77ef2d964693 Credits 1337Wannabe Required...

showroom.swstucson.com Cross Site Scripting vulnerability OBB-3956753

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Element Pack Elementor Addons Plugin <= 5.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Element Pack Elementor Addons Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7247 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 3540915b141a Credits Webbernaut...

WordPress WooCommerce Social Login Plugin <= 2.7.5 is vulnerable to Broken Authentication

Software WooCommerce Social Login Type Plugin Vulnerable versions = 2.7.5 Fixed in 2.7.6 OWASP Top 10 A4: Insecure Design Classification Broken Authentication CVE CVE-2024-7503 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 23315c373121 Credits Truoc Phan Required...

WordPress Term And Category Based Posts Widget Plugin < 4.9.13 is vulnerable to Cross Site Scripting (XSS)

Software Term And Category Based Posts Widget Type Plugin Vulnerable versions 4.9.13 Fixed in 4.9.13 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-6158 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 2ddaec10bd6e Credits Dmitrii Ignatyev...

WordPress PDF Builder for WPForms Plugin <= 1.2.116 is vulnerable to Full Path Disclosure (FPD)

Software PDF Builder for WPForms Type Plugin Vulnerable versions = 1.2.116 Fixed in 1.2.117 OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-7414 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c08822324936 Credits stealthcopt...

WordPress WP eStore Plugin < 8.5.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP eStore Type Plugin Vulnerable versions 8.5.6 Fixed in 8.5.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-6136 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID cbacff106a90 Credits Bob Matyas Required privileg...

WordPress WP eStore Plugin < 8.5.6 is vulnerable to Cross Site Scripting (XSS)

Software WP eStore Type Plugin Vulnerable versions 8.5.6 Fixed in 8.5.6 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6133 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0478cdd4af65 Credits Bob Matyas Required...

WordPress Compute Links Plugin <= 1.2.1 is vulnerable to Remote File Inclusion

Software Compute Links Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Remote File Inclusion CVE CVE-2024-43261 Patch priority High CVSS severity High 9.6 Developer Claim ownership PSID 6b5b6ec353fd Credits YCInfosec Required privilege Unauthenticate...

WordPress Atarim Plugin <= 4.0.2 is vulnerable to Broken Access Control

Software Atarim Type Plugin Vulnerable versions = 4.0.2 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7621 Patch priority Low CVSS severity Low 5.4 Developer Atarim PSID 410d656b7615 Credits Lucio Sá Required privilege Subscriber Published...

WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43241 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 75c4d13f2043 Credits Rafie Muhammad Patchstack...

WordPress Masteriyo - LMS Plugin <= 1.11.4 is vulnerable to Insecure Direct Object References (IDOR)

Software Masteriyo - LMS Type Plugin Vulnerable versions = 1.11.4 Fixed in 1.11.5 OWASP Top 10 A1: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2024-43239 Patch priority Low CVSS severity Low 4.3 Developer Masteriyo PSID 14f36e53d575 Credits Ananda Dhakal...

WordPress JobSearch Plugin <= 2.3.4 is vulnerable to Privilege Escalation

Software JobSearch Type Plugin Vulnerable versions = 2.3.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Privilege Escalation CVE CVE-2024-43245 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID dba18ffc45d3 Credits Dave Jong Patchstack Required...

WordPress Bit Form Pro Plugin <= 2.6.4 is vulnerable to Sensitive Data Exposure

Software Bit Form Pro Type Plugin Vulnerable versions = 2.6.4 Fixed in 2.8.0 OWASP Top 10 A1: Broken Access Control Classification Sensitive Data Exposure CVE CVE-2024-43251 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 6d6af3324445 Credits Dave Jong Patchstack...

fiberer.com Cross Site Scripting vulnerability OBB-3955136

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

fairish-seitai.com Cross Site Scripting vulnerability OBB-3955009

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tunnel-rush.online Cross Site Scripting vulnerability OBB-3954916

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

autodent.gr Cross Site Scripting vulnerability OBB-3953975

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Persian WooCommerce Plugin <= 7.1.6 is vulnerable to Broken Access Control

Software Persian WooCommerce Type Plugin Vulnerable versions = 7.1.6 Fixed in 9.0.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43219 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 2fdf96331252 Credits Rafie Muhammad Patchstack...

WordPress Shared Files Plugin <= 1.7.28 is vulnerable to Sensitive Data Exposure

Software Shared Files Type Plugin Vulnerable versions = 1.7.28 Fixed in 1.7.29 OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2024-43230 Patch priority Low CVSS severity Low 5.3 Developer Tammersoft PSID 9e141e472eac Credits Abdi Pranata Required privile...